European Aviation Safety Agency
Notice of Proposed Amendment 2017-07
Rotorcraft gearbox loss of lubrication
RMT.0608
EXECUTIVE SUMMARY
The objective of this NPA is to address a safety issue related to the ability of Category A rotorcraft to continue safe flight
for an extended duration after suffering a loss of oil from a gearbox that is reliant on a pressurised lubrication system to
provide lubrication and cooling of rotating components.
The specific objective is to reduce the level of risk associated with loss of lubrication of rotorcraft gearboxes and to
implement recommendations arising from the Joint Certification Team (JCT) review of rotorcraft gearbox certification
specifications (CSs). This aims to both reduce the potential for lubrication system failures from occurring and to mitigate
the consequences of any failure.
The objective shall be achieved by improving the safety assessment of pressurised lubrication systems, and by improving
the certification and development testing specifications for the ‘loss of lubrication’ condition in order to substantiate a
maximum period of continued operation which can be included in the rotorcraft flight manual (RFM) emergency
procedures. More specifically, this NPA proposes to amend CS 29.917(a) to include rotor drive system gearbox lubrication
systems in the definition of the rotor drive system. This means that these lubrication systems will be considered to be
within the scope of the design assessment of 29.917(b). As the design assessment CS currently addresses the risk of
single hazardous and catastrophic failures, additional material has been added to complement the Federal Aviation
Administration (FAA) Advisory Circular (AC) 29-2C, supporting 29.917(b), specifically in the domain of lubrication systems.
CS 29.927(c) on ‘loss of lubrication’ has been completely revised and replaced by a more objective-based CS that requires
substantiation of the gearbox ability to continue safe operation (for at least 30 minutes) after a loss of lubrication to be
followed by a safe landing. This is supported by substantial changes to the associated acceptable means of compliance
(AMC). Finally, CS 29.1521 has also been amended to include an additional power plant limitation that describes how the
RFM emergency procedures should reflect the test evidence relating to a loss of lubrication.
The proposed changes are expected to provide an increase in the safety level of rotorcraft operations.
Action area: Rotorcraft operations
Affected rules: ED Decision 2003/15/RM (CS-27))
ED Decision 2003/16/RM (CS-29
Affected stakeholders: Rotorcraft design organisations and operators
Driver: Safety Rulemaking group: Yes
Impact assessment: Full Rulemaking Procedure: Standard
22.05.2014 31.05.2017 2017/Q3
TE.RPRO.00034-006 © European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 1 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
Table of contents
Table of contents
1. About this NPA ..................................................................................................................................... 3
1.1. How this NPA was developed ...................................................................................................................3
1.2. How to comment on this NPA...................................................................................................................3
1.3. The next steps ...........................................................................................................................................3
2. In summary — why and what ............................................................................................................... 4
2.1. Why we need to change the rules — issue/rationale...............................................................................4
2.2. What we want to achieve — objectives ...................................................................................................5
2.3. How we want to achieve it — overview of the proposals ........................................................................5
2.4. What are the expected benefits and drawbacks of the proposals ...........................................................6
3. Proposed amendments and rationale in detail ...................................................................................... 7
3.1. Draft certification specifications (Draft EASA decision) ............................................................................7
3.2. Draft acceptable means of compliance and guidance material (Draft EASA decision) .........................10
4. Impact assessment (IA) ....................................................................................................................... 22
4.1. What is the issue .....................................................................................................................................22
4.2. What we want to achieve — objectives .................................................................................................25
4.3. How it could be achieved — options ......................................................................................................25
4.4. Methodology and data............................................................................................................................26
4.5. What are the impacts..............................................................................................................................26
4.6. Conclusion ...............................................................................................................................................29
4.7. Monitoring and evaluation .....................................................................................................................30
5. References ......................................................................................................................................... 31
5.1. Related regulations .................................................................................................................................31
5.2. Affected decisions ...................................................................................................................................31
5.3. Other reference documents ...................................................................................................................31
TE.RPRO.00034-006 © European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 2 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
1. About this NPA
1. About this NPA
1.1. How this NPA was developed
The European Aviation Safety Agency (EASA) developed this NPA in line with Regulation (EC)
No 216/20081 (hereinafter referred to as the ‘Basic Regulation’) and the Rulemaking Procedure2. This
rulemaking activity is included in the EASA 5-year Rulemaking Programme3 under rulemaking task
RMT.0608. The text of this NPA has been developed by EASA based on the input of the rulemaking
group (RMG) RMT.0608. It is hereby submitted to all interested parties4 for consultation.
1.2. How to comment on this NPA
Please submit your comments using the automated Comment-Response Tool (CRT) available at
http://hub.easa.europa.eu/crt/5.
The deadline for submission of comments is 31 July 2017.
1.3. The next steps
Following the closing of the public commenting period, EASA will review all comments.
Based on the comments received, EASA will develop a decision amending the certification
specifications (CSs) and acceptable means of compliance (AMC) to CS-27 and CS-29.
The comments received and the EASA responses will be reflected in a comment-response document
(CRD). The CRD will be annexed to the decision.
1
Regulation (EC) No 216/2008 of the European Parliament and of the Council of 20 February 2008 on common rules in the field of
civil aviation and establishing a European Aviation Safety Agency, and repealing Council Directive 91/670/EEC,
Regulation (EC) No 1592/2002 and Directive 2004/36/EC (OJ L 79, 19.3.2008, p. 1) (http://eur-lex.europa.eu/legal-
content/EN/TXT/?qid=1467719701894&uri=CELEX:32008R0216).
2
EASA is bound to follow a structured rulemaking process as required by Article 52(1) of Regulation (EC) No 216/2008. Such a
process has been adopted by the EASA Management Board (MB) and is referred to as the ‘Rulemaking Procedure’. See MB Decision
No 18-2015 of 15 December 2015 replacing Decision 01/2012 concerning the procedure to be applied by EASA for the issuing of
opinions, certification specifications and guidance material (http://www.easa.europa.eu/the-agency/management-
board/decisions/easa-mb-decision-18-2015-rulemaking-procedure).
3
http://easa.europa.eu/rulemaking/annual-programme-and-planning.php
4
In accordance with Article 52 of Regulation (EC) No 216/2008 and Articles 6(3) and 7) of the Rulemaking Procedure.
5
In case of technical problems, please contact the CRT webmaster (
[email protected]).
TE.RPRO.00034-006 © European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 3 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
2. In summary — why and what
2. In summary — why and what
2.1. Why we need to change the rules — issue/rationale
CS 29.927(c) currently requires a test to be perfomed to demonstrate that any failure that can result in
a loss of lubricant will not impair the capability of the rotorcraft to operate under autorotative
conditions for 15 minutes (Category B) or to continue safe flight for at least 30 minutes (Category A)
unless such failures have a probability which is considered to be ‘extremely remote’.
Service experience has highlighted a number of concerns with regard to the existing approach,
including:
— Use of the term ‘extremely remote’: the complexity of lubrication system failure modes can
result in the potential for unforeseen variables which can make prediction of their associated
criticality and frequency of occurrence very challenging. Accordingly, it may not be possible to
apply the ‘extremely remote’ concept to some lubrication system failures as the confidence level
of any associated assumptions may not be adequate.
— Substantiation of gearbox loss of oil endurance: when complying with CS 29.927(c), completion
of a 30-minute test simulating a ‘loss of lubrication’ condition will typically result in an associated
RFM emergency procedure requiring that the rotorcraft be landed in a considerably shorter
period of time. Taking into account the challenging environmental conditions associated with
certain types of Category A rotorcraft operations, a substantiated capability for continued
operation of at least 30 minutes after loss of lubrication, to be stated in the associated RFM
emergency procedures, would improve the likelihood of a positive outcome of such an event.
— Safety analysis: gearbox lubrication systems are currently not defined as part of the rotor drive
system and are, therefore, not automatically subject to CS 29.917(b), which requires a design
assessment of the rotor drive system. Consideration of lubrication system safety via other
approaches may not be fully representative as lubrication systems are typically an integral part
of the rotor drive system.
Furthermore, a number of issues were highlighted by an accident which occurred on 12 March 2009,
involving a Canadian-registered Sikorsky S-92A rotorcraft (registration C-GZCH), which experienced an
in-flight loss of lubrication of its main gearbox (MGB). The MGB eventually failed, contributing to a loss
of control and subsequent crash. The investigation revealed that the loss of MGB lubrication was due
to failure of the titanium studs that retain the MGB oil filter housing. The designated safety
investigation authority the Canadian Transport Safety Board (TSB), in its safety investigation report
(Aviation Investigation Report A09A0016) of February 2011, made the following two recommendations
for changes to the airworthiness design standard:
— A11-01:
The Federal Aviation Administration, Transport Canada and the European Aviation Safety Agency
remove the ‘extremely remote’ provision from the rule requiring 30 minutes of safe operation
following the loss of main gearbox lubricant for all newly constructed Category A transport
helicopters and, after a phase-in period, for all existing ones; and
— A11-02:
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 4 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
2. In summary — why and what
The Federal Aviation Administration assess the adequacy of the 30 minute main gearbox run dry
requirement for Category A transport helicopters.
In response to this accident and the corresponding TSB safety recommendations, the Transport Canada
Civil Aviation (TCCA), the FAA and EASA created the Joint Cooperation Team (JCT). The objective of this
team was to conduct a review of the current design CSs and AMC relating to the certification of
rotorcraft gearboxes, specifically with respect to loss of lubrication. The JCT completed this review and
made recommendations regarding the adequacy of the current CSs, including the use of the ‘extremely
remote’ criterion. These recommendations propose a harmonised action to address gaps identified in
the existing CSs, clarify their intent, and redefine test CSs to allow substantiation of a greater
endurance capability in the event of a loss of lubrication.
2.2. What we want to achieve — objectives
The overall objectives of the EASA system are defined in Article 2 of the Basic Regulation. This proposal
will contribute to the achievement of the overall objectives by addressing the issues outlined in
Chapter 2.1.
The specific objective of this proposal is to minimise the risk of hazardous and catastrophic failures
related to loss of lubrication from rotorcraft gearboxes using pressurised lubrication systems. In
determining the scope of this rulemaking task, RMG RMT.0608 considered and reviewed the JCT
recommendations. The amendments to the CSs and their associated AMC proposed in this NPA aim to
both minimise the likelihood of hazardous and catastrophic lubrication system failures as well as
mitigate the likely consequences of any failure. This will be achieved by improving the safety
assessment of pressurised lubrication systems, as well as the certification test specifications to
demonstrate the behaviour of gearboxes experiencing loss of lubrication in order to substantiate a
maximum period of continued operation which can be included in the RFM emergency procedures.
The scope of this NPA is to address this safety issue with respect to CS-29 and CS-27 Category A
helicopters. Accordingly, the amendments proposed in this NPA are limited to CS-29 and the
associated AMC. For CS-27 Category A rotorcraft, the safety implications of gearbox loss of lubrication
are less significant due to both design and operational differences. Notwithstanding this amendments
will be proposed to both CS 29.917(b) and CS 29.927(c), which will result in the changes becoming
applicable to CS-27 Category A rotorcraft, as these CSs are listed within CS-27 Appendix C which
contains the additional provisions for CS-27 Category A rotorcraft. Furthermore, as each of the CS-29
amendments proposed by this NPA are interrelated, it is proposed that each of the amended
provisions should also be referenced in CS-27 Appendix C. The impact on CS-27 Category A rotorcraft is
addressed in Chapter 4 of this NPA.
2.3. How we want to achieve it — overview of the proposals
This NPA proposes to amend CS 29.917(a) to include rotor drive system gearbox lubrication systems in
the definition of the rotor drive system. This will result in these lubrication systems being considered
within the scope of the design assessment of CS 29.917(b). As the scope of this design assessment is
currently limited to single hazardous and catastrophic failures, additional AMC are needed to
supplement FAA AC 29-2C, supporting CS 29.917(b), specifically with regard to lubrication systems.
CS 29.927(c), addressing loss of lubrication for Category A rotorcraft, has been significantly changed.
This is now a more objective-based CS and requires substantiation of the ability of the gearbox to
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 5 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
2. In summary — why and what
continue safe operation for at least 30 minutes after indication of low oil pressure, followed by a safe
landing. Demonstration includes a minimum of one test within the certification programme, simulating
the most severe failure mode of the normal-use lubrication system. The most severe failure mode of
the normal-use lubrication system is determined by the design assessment previously mentioned. The
test begins by establishing the necessary entry operating conditions and, upon indication that a
lubrication failure has occurred, the rotorcraft continues to operate for one minute at maximum
continuous power. This is followed by a period of operation proposed by the applicant (of no less than
36 minutes) at the minimum power setting for continued flight. The test concludes with a 45-second
period at a power setting that simulates landing. The results allow substantiation of an acceptable
safety margin against the 30-minute requirement by means of extended duration at minimum power
for continuous flight, multiple tests, or any other acceptable approach proposed by the applicant.
Substantiation of a continued flight capability exceeding 30 minutes may be possible using an
extended test duration provided that an appropriate safety margin has been substantiated. The new
test definition will be supported by substantial amendments to the supporting AMC.
Finally, CS 29.1521 has been modified, by adding an additional powerplant limitation stating the need
for the RFM emergency procedures to reflect the test evidence relating to the loss of gearbox
lubrication.
Note: TSB ASR A11-01 recommends taking action to address all newly constructed Category A
transport helicopters and, after a phase-in period, all existing ones. A review of helicopter types
certified in accordance with the current CS 29.927(c) has shown that most types complied without
using the ‘extremely remote’ rationale to exclude particular lubrication system failure modes. For
helicopter types where potential lubrication system failure modes were excluded from the ‘loss of
lubrication’ test on the basis of extremely remote likelihood of occurence, additional actions have
been taken to ensure that an acceptable level of safety is maintained.
CS-27 Appendix C, which identifies additional provsions for Category A rotorcraft, is amended to
include each of the CS-29 amendments proposed by this NPA.
2.4. What are the expected benefits and drawbacks of the proposals
Compliance with a ‘loss of lubrication’ test by all CS-29 Category A new rotorcraft types will ensure
that continued level flight at maximum take-off gross weight can be maintained for a defined duration
after loss of lubrication. This duration will be specified in the emergency procedures for loss of
lubrication in the RFM. This provision will provide increased opportunity for the flight crew to optimise
circumstances affecting the safety of the eventual landing.
The only significant drawbacks of this proposal are economic. This results from the increased cost of
certification testing, and potential for increased weight of the gearbox and lubrication system,
dependant upon the design solution chosen by the applicant. But the impact to CS-29 helicopter
manufacturers is considered to be negligible.
For the full impact assessment of alternative options, please refer to Chapter 4.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 6 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
3. Proposed amendments and rationale in detail
The text of the amendment is arranged to show deleted text, new or amended text as shown below:
— deleted text is struck through;
— new or amended text is highlighted in grey;
— an ellipsis ‘[…]’ indicates that the rest of the text is unchanged.
3.1. Draft certification specifications (Draft EASA decision)
3.1.1. Draft resulting text: CS-27 – Book 1
APPENDICES
1. Amend CS-27 Appendix C as follows:
Appendix C
Criteria for Category A
C27.1 General: A small multi-engine rotorcraft may not be type certificated for Category A operation
unless it meets the design installation and performance requirements provisions contained in this
appendix in addition to the requirements provisions of this CS-27.
C27.2 Applicable CS-29 paragraphs. The following paragraphs of CS-29 must be met in addition to the
requirements provisions of this codeCS:
(…)
29.908(a) — Cooling fans.
29.917(a), (b) and (c)(1) — Rotor drive system: Design. (29.917(a) replaces
27.917(d))
29.927(c)(1) and (c)(2) — Additional tests.
(...)
29.1351(d)(2) — Additional requirements for Category A rotorcraft
(Operation with the normal electrical power
generating system inoperative.)
29.1521(k) — Powerplant limitations.
(…)
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 7 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
3.1.2. Draft resulting text: CS-29 – Book 1
BOOK 1
SUBPART E — POWERPLANT
2. Amend CS 29.917 as follows:
CS 29.917 Design
(a) General. The rotor drive system includes any part necessary to transmit power from the engines
to the rotor hubs. This includes gearboxes, shafting, universal joints, couplings, rotor brake
assemblies, clutches, supporting bearings for shafting, any attendant accessory pads or drives,
lubricating systems for drive system gearboxes, oil coolers and any cooling fans that are part of,
attached to, or mounted on the rotor drive system.
(…)
3. Amend CS 29.927 as follows:
CS 29.927 Additional tests
(a) Any additional dynamic, endurance, and operational tests, and vibratory investigations
necessary to determine that the rotor drive mechanism is safe, must be performed.
(…)
(c) Lubrication system failure. For lubrication systems required for proper operation of rotor drive
systems, the following apply:
(1) Category A. Unless such failures are extremely remote, it must be shown by test that any
failure which results in loss of lubricant in any normal use lubrication system will not
prevent continued safe operation, although not necessarily without damage, at a torque
and rotational speed prescribed by the applicant for continued flight, for at least 30
minutes after perception by the flight crew of the lubrication system failure or loss of
lubricant. Confidence shall be established that the rotor drive system has an in-flight
operational endurance capability of at least 30 minutes following lubrication system
failure.
(2) Category B. The requirements of Category A apply except that the rotor drive system need
only be capable of operating under autorotative conditions for at least 15 minutes.
Demonstration must include a test of at least 36 minutes, dependent upon the number of
tests and component condition after test, following simulation of the most severe failure
mode of the normal-use lubrication system as determined by the failure analysis of
CS 29.917(b). The test shall be conducted such that it begins upon the indication to the
flight crew that a lubrication failure has occurred and its loading is consistent with one
minute at maximum continuous power followed by the minimum power needed for
continued flight at rotorcraft maximum gross weight. The test shall end with a 45-second
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 8 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
out of ground effect (OGE) hover to simulate a landing phase. Test results must
substantiate an acceptable positive margin against the 30-minute requirement by means
of an extended test duration, multiple test specimens, or other approach prescribed by
the applicant and accepted by EASA, and must support the procedures published in the
rotorcraft flight manual (RFM). Flight duration longer than 30 minutes may be
demonstrated by means of a correspondingly longer test with appropriate margin and
substantiation.
(3) Category B. Confidence shall be established that the rotor drive system has an in-flight
operational endurance capability to complete an autorotation descent and landing
following a lubrication system failure.
(4) Demonstration must include a test of at least 15 minutes and 30 seconds following the
most severe failure mode of the normal-use lubrication system as determined by the
failure analysis of CS 29.917(b). The test shall be conducted such that it begins upon the
indication to the flight crew that a lubrication failure has occurred and its loading is
consistent with 15 seconds at maximum continuous power after which input torque
should be reduced to simulate autorotation for 15 minutes. The test shall be completed by
application of an input torque to simulate minimum power landing for approximately
15 seconds.
(…)
4. Amend CS 29.1521 as follows:
CS 29.1521 Powerplant limitations
(a) General. The powerplant limitations prescribed in this paragraph must be established so that
they do not exceed the corresponding limits for which the engines are type certificated.
(…)
(k) Continued operation after rotor drive system gearbox loss of lubrication. For gearboxes which
utilise a pressurised lubrication system, the maximum duration of operation after a failure
resulting in loss of lubrication and ‘red oil pressure’ warning must not exceed the maximum
period demonstrated during certification, as prescribed by CS 29.927(c).
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 9 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
3.2. Draft acceptable means of compliance and guidance material (Draft EASA decision)
3.2.1. Draft resulting text: CS-29 – Book 2 (Acceptable Means of Compliance and Guidance Material)
5. Amend AMC 29.917 (amendment of AC 29.917) as follows:
AMC 29.917
Rotor drive system design
Vibration Health Monitoring: Where Vibration Health Monitoring is used as a compensating provision
to meet CS 29.917(b), the design and performance of the vibration health monitoring system should be
approved by requesting compliance with CS 29.1465(a).
Lubrication Systems: A dedicated safety assessment should be performed addressing all rotor drive
gearbox lubrication systems and, in particular, the following:
(a) Identification of any single failures, malfunction, or foreseeable combination of failures that may
result in loss of oil supply to dynamic components. This normally takes the form of a failure
mode and effects analysis. Compensating provisions should be identified to minimise the
likelihood of occurrence of these failures.
(b) Identification of the most severe failure mode that results in the shortest duration of time in
which the gearbox should be able to operate following indication to the flight crew of a normal-
use lubrication system failure. This should be used for simulating lubrication failure during the
CS 29.927(c) loss of lubrication test.
(c) Where compliance with CS 29.927(c) is reliant upon operation of an auxiliary lubrication system,
sufficient independence between the normal-use and auxiliary lubrication systems should be
substantiated. Common-cause failure analysis, including common-mode, particular-risk, and
zonal safety analyses, should be performed. It should be established that no single failure or
identified common-cause failure will prevent operation of both normal-use and auxiliary
lubrication systems, apart from failures determined to be extremely remote lubrication failures.
6. Create a new AMC 29.927 (amendment of AC 29.927) as follows:
AMC 29.927
Additional tests
This AMC replaces FAA AC 29.927 (Amendment 29-26)
(a) Explanation
(1) AMC 29.927 revises the rotor drive systems loss of lubrication test provisions for
Category A rotorcraft, as defined in CS 29.927(c). This changes the related requirement to
show a capability through testing of at least 36 minutes’ duration. Additionally, minimum
periods and load conditions are now defined directly in theprovision. The failure condition
to be simulated is the most severe loss of lubrication failure mode of the normal-use
lubrication system, which is defined below. In addition, the term ‘unless such failures are
extremely remote’ has been removed from the requirement. Assessment of the
lubrication system reliability is now addressed under 29.917(b).
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 10 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
(2) The provision is intended to apply to pressurised lubrication systems and should not be
applied to splash-lubricated gearboxes since historically, their design has not been as
critical or complex when compared to pressurised systems. The likelikood of loss of
lubrication is significantly greater for gearboxes that use pressurised lubrication and
external cooling. This is due to the increased complexity of the lubrication system, the
external components that circulate oil outside of the gearbox, and the resultant rapid
leakages that may occur with a pressurised system. A pressurised lubrication system is
more commonly used in the rotorcraft’s main gearbox but may also be used in other rotor
drive system gearboxes. Dedicated loss of lubrication testing is not required for gearboxes
using non-pressurised splash lubrication systems. However, any assumptions regarding
this failure condition should be stated in the functional hazard analysis (FHA) along with
adequate justification.
(3) This provision is applicable to any pressurised lubrication gearbox that is essential for
continued safe flight and safe landing. Accordingly, this provision is not applicable to
gearboxes which are not essential for continued safe flight and safe landing and which
have a lubrication system which is independent of other essential gearboxes.
(4) The lubricating system has two primary functions. The first is to provide lubricating oil to
contacting or rubbing surfaces to reduce heat energy generated by friction. The second is
to dissipate heat energy generated by friction of meshing gears and bearings, thus
maintaining surface and component temperature. Accordingly, a loss of lubrication leads
to increased friction between components and increased component surface
temperatures. With increased component surface temperatures, surface hardness may be
lost resulting in the inability of the component to carry or transmit loads appropriately.
Thermal expansion in gearbox components may eventlually lead to the mechanical failure
of bearings, journals, gears, shafts, and clutches that are subjected to high loads and
rotational speeds. A loss of lubrication may result from internal and external failures.
Failures include, but are not limited to: oil lines, fittings, seal plugs, sealing gaskets, valves,
pumps, oil filters, oil coolers, accessory pads, etc.
(5) The intent of the rule change for Category A rotorcraft is to provide confidence in the
continued flight capability of the rotorcraft, which should be of at least 30 minutes’
duration after the loss of lubricant pressure in any single rotorcraft drive system gearbox,
aiming to optimise eventual landing opportunities. In order to enable the crew to
determine the safest action in the event of loss of gearbox oil, the emergency procedures
of the rotorcraft flight manual (RFM) should include instructions defining the maximum
time period within which the rotorcraft should have landed. This AMC provides guidance
for completion of the loss of lubrication test and on how to demonstrate confidence in the
margin of safety associated with the maximum period of operation following loss of
lubrication, as defined in the RFM emergency procedures. This margin of safety is
intended to substantiate a period of operation that has been evaluated as likely to be
safer than making a forced landing over hostile terrain.
(b) Procedures
(1) CS 29.927(c) prescribes a test which is intended to demonstrate that no hazardous failure
or malfunction will occur within a defined period, and in a specified reduced-power
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 11 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
condition, in the event of a significant failure of the rotor drive lubrication system. The
failure of the lubrication system should not impair the ability of the crew to continue safe
operation of Category A rotorcraft for the defined period after indication of the failure has
been provided to the flight crew. For Category B rotorcraft, safe operation under
autorotative conditions should be possible for a period of at least 15 minutes. Some
damage to rotor drive system components is acceptable after completion of the
lubrication system testing. However, the condition of the components will influence the
margin of confidence established for the maximum period of operation following loss of
lubrication.
(2) Since this is a test of the capability of the gearbox to operate with residual oil or oil
supplied from an auxiliary lubrication system, the method for draining the oil and the
operating conditions are also defined in the provision . The entry condition for the test
should also be representative and is defined in this AMC. For Category B rotorcraft, it is
necessary to simulate an autorotation for a period of 15 minutes followed by a minimum-
power landing.
(c) Definitions
For the purposes of this test and assessment of continued operation after loss of lubrication, the
following definitions apply:
(1) Maximum period of operation following loss of lubrication: this is the period stated in the
RFM emergency procedures. This is only intended to be used in conjunction with the
instruction to ‘Land as soon as possible’. Accordingly, this does not constitute a safe
period of operation, but a period that has been evaluated as likely to be safer than making
a forced landing over hostile terrain.
(2) Most severe failure mode: it is defined as the failure mode that results in the shortest
duration of time in which the gearbox is expected to operate following indication of a
normal-use lubrication system failure to the flight crew.
(3) Residual oil: the oil present in the gearbox after experiencing the most severe failure
mode. (Note: when the lubrication system incorporates an auxiliary lubrication system,
this will supplement the residual oil in the event of failure of the normal-use lubrication
system).
(4) Normal-use lubrication system: the lubrication system relied upon during normal
operation.
(5) Auxiliary lubrication system: any lubrication system that is independent of the normal-use
lubrication system.
(6) Independent: an auxiliary lubrication system should be able to function after failure of the
normal-use lubrication system. Failure modes which may result in the subsequent failure
of both auxiliary and normal-use lubrication systems should be shown to be extremely
remote lubrication failures.
(7) Extremely remote lubrication failure: lubrication failures where confidence is provided that
the likelihood of occurrence of the failure mode has been minimised, either by structural
analysis in accordance with CS 29.571, laboratory testing, service experience or other
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 12 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
means indicating a level of reliability better than one failure per 10 million hours.
Typically, failure modes involving external pipes or hoses should not be considered as
extremely remote lubrication failures.
(d) Certification test configuration
Each gearbox lubricated by a pressurised system that is essential for continued safe flight and
safe landing should be tested. Deviations from the gearbox configuration being certified may be
allowed where necessary for installation of test instrumentation or equipment to facilitate
simulation of the most severe failure mode.
(e) Loss of lubrication test
(1) Category A rotorcraft
(i) Test entry condition: the test starting condition should be 100 % of the torque
associated with all engines operative (AEO) maximum continuous power (MCP) and
at the nominal speed for use with MCP. In addition, the torque necessary for the
anti-torque function should be simulated for straight and level flight at the same
flight conditions. The oil temperature should be stabilised at the maximum oil
temperature limit for normal operation.
(ii) Draining of oil: once the oil temperature has stabilised at the maximum declared oil
temperature limit for normal operation, the oil should be drained simulating the
most severe failure mode of the normal-use lubrication system. the most severe
failure mode should be determined by the failure analysis of CS 29.917(b). The
location and rate of oil drainage should be representative of the mode being
simulated.
(iii) Depleted-oil run: upon illumination of the ‘low oil pressure’ warning or other
indication, as required by CS 29.1305, continue to operate at AEO MCP and the
nominal speed for use in this condition for 1 minute. Then, reduce the torque values
to be equal to or greater than those necessary to sustain flight at the maximum
gross weight and the most efficient flight conditions under standard atmospheric
conditions (Vy). This condition should be maintained for at least 36 minutes. When
determining the torque values to sustain flight at the maximum gross weight and
the most efficient flight conditions (Vy), it should be assumed that the condition
starts at 100 % maximum take-off weight (MTOW), and, thereafter, consideration
for fuel burn during the test is allowed.
(iv) Simulated landing: to complete the test, power should be applied to the gearbox for
at least 45 seconds to simulate an out of ground effect (OGE) hover.
(v) Test conditions: for (i) to (iv) above, the input and output shaft torques should be
reacted, as appropriate, at the input and output quills, and the corresponding input
and output shaft loads should be applied. The main gearbox’s vertical load should
be applied at the mast, and should be equal to the maximum gross weight of the
rotorcraft at 1 g.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 13 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
(vi) This test may be conducted on a representative bench test rig. The test should be
performed with all the accessory loads represented by a load associated with
normal cruise conditions.
(vii) For successful demonstration, the gearbox should continue to transmit the
necessary torque to the rotors throughout the duration of the test. The loss of drive
to accessories which are essential for continued flight should constitute a test
failure.
(2) Category B rotorcraft
(i) The provisionsfor Category A apply except that the rotor drive system need only
perform a depleted-oil run for 15 minutes operating at a torque and speed to
simulate autorotative conditions.
(ii) A successful demonstration may involve limited damage to the rotor drive system
provided that it is established that the autorotative capabilities of the rotorcraft
were not significantly impaired. If compliance with Category A provisons is
demonstrated, Category B provisionswill be considered to have been met.
(3) The test parameters described in (e)(1) above have been chosen to represent an
occurrence of loss of oil in flight, namely a reaction/transition period for the crew to be
able to reduce power followed by an extended period at reduced power for continued
flight at Vy. When determining the torque necessary for the reduced-power segment of
this test, an international standard atmosphere (ISA) sea level condition is considered to
be acceptable.
(4) Should the applicant wish to establish a positive safety margin for a Category A rotorcraft
for a maximum period of operation following loss of lubrication longer than 30 minutes, it
will be necessary to extend the test duration representing flight at Vy, described in
(e)(1)(iii) above.
(f) Determination of the Most Severe Failure Mode
(1) The objective of the loss of lubrication test is to demonstrate operation following the most
severe failure mode of the normal-use lubrication system. The determination of the most
severe failure mode may not be immediately obvious, as leakage rates vary, and system
performance following leaks from different areas varies as well. Thus, a careful analysis of
the potential failure modes should be conducted.
(2) The starting point for determination of the most severe failure mode should be an
assessment of all potential lubrication system failure modes. This should be accomplished
as part of the CS 29.917(b) design assessment, and include leaks from any connections
between components assembled together, such as threaded connections, hydraulic
inserts, gaskets, seals, and packings (O-rings). Failure modes, such as failure of externals
lines, component retention hardware and wall-through cracks that have not been
substantiated for CS 29.307, CS 29.571 and CS 29.923(m) should also be considered. The
determination that a failure is an extremely remote lubrication failure, when used to
eliminate a potential failure mode from being considered as a candidate most severe
failure mode, should be substantiated. Where leakage rates or the effect of failure modes
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 14 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
cannot be easily determined, then a laboratory test should be conducted. Once the most
severe failure mode has been determined, this should form the basis of the conditions for
the start of the test.
(g) Use of an auxiliary lubrication system
Use of an auxiliary lubrication system may be an acceptable means of providing extended
operating time after loss of lubrication. The auxiliary lubrication system should be designed to
provide sufficient independence from the normal-use lubrication system. Since the auxiliary
lubrication system is by definition integral to the same gearbox as the normal-use lubrication
system, it may be impractical for it to be completely independent. Therefore, designs should be
conceived such that shared components or interfaces between the normal-use and auxiliary
lubrication systems are minimised and comply with the design assessment provisions of
CS 29.917(b). Failure of any common feature shared by both the normal-use and auxiliary
lubrication systems which could result in the failure of both systems should be shown to be an
extremely remote lubrication failure. If compliance with CS 29.927(c) is reliant on the functioning
of an auxiliary lubrication system, then:
(1) in the unlikely event of a combined failure of both the normal-use lubrication system and
the auxiliary lubrication system, the RFM emergency procedures should instruct the flight
crew to ‘Land immediately’ unless testing representing this failure mode has been
performed in order to substantiate that an increased duration is justified; and
(2) a means of verifying that the auxiliary lubrication system is functioning properly should be
provided during normal operation of the normal-use lubrication system. However, if there
are no such means, the flight crew should be alerted in the event of a detection of a
malfunction of the auxiliary lubrication system.
(h) Independence of the auxiliary lubrication system.
(1) In order to ensure that the auxiliary lubrication system is sufficiently independent:
(i) failure of the pressurised portion of the normal-use lubrication system should not
result in a subsequent failure of the auxiliary lubrication system;
(ii) common failure modes shown to defeat both the normal-use and the auxiliary
lubrication systems should be shown to be extremely remote lubrication failures;
and
(iii) control systems, logic and health-reporting systems should not be shared;
consideration should be given to the design process to ensure appropriate
segregation of control and warning systems in the system architecture.
(2) Methods which should be used to demonstrate that failure modes of common areas are
extremely remote include:
(i) field experience of the exact design with an exact application;
(ii) field experience with a similar design/application with supporting test data to allow
comparison;
(iii) demonstration by test of extremely low leakage rates;
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 15 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
(iv) redundancy of design;
(v) structural substantiation with a high safety margin for elements of the lubrication
systems assessed against CS 29.571; and
(vi) assessement of potential dormant failure modes of the auxiliary lubrication system
and in order to minimise this risk, determination of the health of the auxiliary
lubrication system prior to each flight.
(i) Determination of the maximum period of operation following loss of lubrication
In order to enable the flight crew to determine the safest action in the event of loss of gearbox
oil, the RFM emergency procedures should include instructions defining the maximum period of
time within which the rotorcraft should land. Accordingly, it is necessary to demonstrate
reasonable confidence in the ability of the gearbox to continue safe operation after experiencing
loss of oil or a lubrication failure. (i)(1) to (i)(5) below describe acceptable means of compliance
(AMC) to demonstrate a level of confidence in the ability of the gearbox to continue safe
operation, after experiencing loss of oil or lubrication failure, for a specified period at given
operating conditions. This AMC explains how the test duration, the number of tests, the
condition of the gearbox components upon completion of the tests, and the gearbox behaviour
during these tests may be combined to establish a positive safety margin when determining the
maximum period of operation following loss of lubrication. However, any other data, in particular
that identified in (i)(6) to (i)(11) below, should also be considered as supporting evidence
regarding the understanding of the gearbox behaviour after loss of lubrication.
(1) Certification test duration
The duration of the loss of lubrication certification test, as defined in (e) above, should be
used as the starting point for determination of the maximum period of operation following
loss of lubrication.
(2) Reduction factor based on supporting data
In order to substantiate the maximum period of operation following loss of lubrication, a
suitable safety factor should be applied to correlate the test duration with the maximum
period of operation following loss of lubrication. Suitable reduction factors are as follows:
(i) ≤ 0.6 should be used where no supporting data is available to provide
understanding of the gearbox behaviour and confidence in the repeatability of the
certification test data.
(ii) ≤ 0.8 should be used where the certification test duration is corroborated by one or
more development tests. The development test results should show consistency of
the temperature history, and demonstrate good correlation with the certification
test.
(iii) ≤ 0.9 should be applied if a high level of understanding of the limiting design
characteristics is established and supported by repeatable test data.
(iv) When determining the appropriate reduction factor, consideration should also be
given to any factors which may reflect the health or stability of gearbox components
during the test(s). These factors are addressed below and include: temperature
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 16 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
history, maximum temperatures achieved with respect to physical limitations of the
material, simulation results, and the time difference between the demonstrated
duration up to test failure and the duration of the certification test.
(3) Reduction factor based on the condition of components at the end of the certification test
This should be applied in accordance with the definitions of (4) below. This fixed-period
reduction should be 2 minutes for CLASS 1 (‘Good’ condition), 5 minutes for CLASS 2 (‘Fair’
condition), and 10 minutes for CLASS 3 (‘Imminent failure’ condition).
(4) Post-test condition of gearbox components
During loss of lubrication tests, components may suffer a progressive state of
damage/deterioration, particularly when when relying on a limited quantity of residual oil,
which may further reduce in quantity and increase in temperature. The classification of
component condition is described below:
CLASS 0 — Intact/serviceable
Parts in new condition. It is impractical to expect components to be in this condition after
the test, but this classification is stated for reference only.
CLASS 1 — Good
— Parts are still well oil-wetted with little or no discolouration (light yellow to
light/local blue).
— Local moderate scuffing of gear teeth and/or local moderate scorings on bearing-
active surfaces is present.
— Hardened surfaces (gear teeth and bearing-active surfaces) may show slight/local
reduction in hardness (maximum 2 points on the Rockwell C Hardness (HRC) scale).
— Normally, operation in these conditions should not significantly alter the vibration
and noise signatures of the gearbox during test.
— The efficiency of the gearbox should be unchanged or reduced by no more than 2 %.
— Gearbox still transmits the required torque and rotates smoothly.
CLASS 2 — Fair
— Parts are almost completely dry, little residual oil in localised areas.
— Dark blue to brown discolouration is present, showing signs of uniform wear.
— Coatings such as silver plating are still visible but may be worn out locally or
discoloured.
— Heavy localised scuffing on gear teeth as well wear on active surface of gear teeth
are visible.
— Surface hardness may have been reduced more significantly (up to a maximum of
4 points on the HRC scale).
— Normally, operation in these conditions could cause moderate changes to the
vibration and noise signatures of the gearbox during test.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 17 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
— Efficiency of the gearbox may be reduced by up to 4 %.
— Gearbox still transmits the required torque.
CLASS 3 — Imminent failure
— Parts show evidence of plastic deformation or melting in local areas due to high
temperatures.
— Macroscopic wear of some of the rolling elements of bearings and gear teeth, with
appreciable alteration of dimensions and associated increase in clearances and
plays.
— Bearing cages are worn or with incipient breakage.
— Normally, operation in these conditions causes significant and audible changes to
the vibration and noise signatures of the gearbox during test.
— Efficiency of the gearbox may be reduced by up to 10 %.
— Gearbox still transmits the required torque and is still capable of rotating
immediately after test (after it has cooled down, it may be more difficult to rotate).
CLASS 4 — Failed
In this case, there is a complete and gross plastic deformation of parts, and bearing balls
and rollers are melted. Parts in this conditions mean that the test specimen has failed,
hence, this classification is also provided for reference only.
(5) Calculation of the maximum period of operation following loss of lubrication
Application of the factors described in (2) and (3) above can be represented by the
following formula:
Td = ( Kr x Tc ) – Tp
where:
— Td is the Maximum Period of Operation Following Loss of Lubrication, for which
confidence has been established and which is to be referenced in the RFM
emergency procedures;
— Kr is the confidence/reliability reduction factor defined in (2) above;
— Tc is the duration of the certification test (from low-pressure indication to end of
test); and
— Tp is a fixed-time reduction factor to account for condition at the end of the test, as
defined in (3) above.
(6) Multiple tests
Further to a full-scale certification test with a test configuration as described in (d) above,
additional full-scale or modular development tests may be performed to increase
confidence when determining the maximum period of operation following loss of
lubrication.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 18 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
(i) When two or more tests are submitted to show compliance with thisprovision, the
test of shortest duration will be considered to be the certification test and should
be used as the basis for demonstrating the maximum period of operation following
loss of lubrication. If excessive variation is experienced between tests, it should be
investigated and explained.
(ii) Note: Where the above text refers to multiple tests this does not necessarily mean
completely different gearboxes. The intent of using data from multiple tests is that
the parts replaced between tests are those potentially limiting the performance of
the gearbox when operating under residual oil or oil supplied from an auxiliary
lubrication system. Where particular design characteristics are known to be critical
to residual oil performance, parts should be selected at the most severe end of the
tolerance range of the dimensions/specifications impacting these characteristics.
(7) Development tests
The applicant is encouraged to perform development tests in order to explore the
behaviour of the gearbox closer to the point of failure. The first objective of this additional
testing is to evaluate the consistency between tests (using different gearbox components),
and the second objective is to evaluate the time difference between the point at which
the certification test was concluded and the likely time of gearbox failure (if the test had
continued). Of equal importance is the identification of the gearbox design features which
are most likely to initiate gearbox failure in the event of continued operation after loss of
lubrication. When using development test results to corroborate the certification test
duration and, thus, support the determination of the maximum period of operation
following loss of lubrication, the criteria for the reconciliation between the development
test data and an official valid test should include:
(i) for full scale loss of lubrication tests:
(A) the test conditions, i.e. loads, entry point and test profile, should be
duplicated on the development test as for the official test, and any deviations
should be substantiated;
(B) the representativeness of parts should be demonstrated and documented;
(C) the test equipment and instrumentation should be qualified and calibrated;
and
(D) the correlation between development and official test should be
demonstrated by absolute temperatures and temperature rates of change;
and
(ii) for modular tests:
(A) the lubrication conditions, loads, entry point and test profile should be
duplicated on the development test compared to the official test;
(B) in particular, the lubrication conditions should be conservatively simulated to
avoid that the isolated module benefits from secondary lubrication from the
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 19 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
boundaries of the module, which may not be representative of the module
conditions in a full test;
(C) the representativeness of parts should be demonstrated and documented;
(D) the test equipment and instrumentation should be qualified and calibrated;
and
(E) the correlation between development and official test should be
demonstrated by correlation of temperatures.
(8) Maximum temperature reached during test
(i) Similarly to the rate of temperature change, general experience from ‘total loss of
lubrication’ tests performed has shown that successful tests do not exceed certain
values of temperature measured at critical locations of the gearbox. The applicant
should record temperature measurements from critical points of the gearbox or at
related locations in order to compare with previous experience. This data should be
used to validate analysis models and to support the application of a high Kr value
when determining the maximum period of operation following loss of lubrication.
(ii) Note: Monitoring devices (i.e. contact temperature probes) in critical locations may
provide additional data to the flight crew to prevent reaching the critical failure
conditions. The degree of reliability and redundancy of such devices should be
considered in the failure analysis.
(9) Temperature rate of change during test
Gearboxes operating after loss of lubrication sometimes exhibit portions of the test where
a stable (approaching to zero temperature rate of change) or meta-stable (‘small’
temperature rate of change) thermal response is maintained. It is considered that
confidence in the behaviour of the gearbox may be greater for a maximum absolute
temperature measured under these conditions in the context of the certification test or an
official test. Portions of the test that exhibit a larger temperature rate of change should be
investigated and substantiated.
(10) Models/simulations
Numerical simulation of loss of lubrication conditions is not considered sufficient to
demonstrate confidence in absolute temperature values achieved during the certification
test, when applied to the prediction of the maximum period of operation following loss of
lubrication. However, it may be possible to apply numerical simulation (0-3 dimensional)
to extrapolate test results to other boundary or entry conditions.
(11) Secondary indication
Another possible means to increase confidence in the ability to continue to operate safely
after suffering loss of lubrication is to provide a secondary indication, which may indicate
when the most critical mode of degradation has progressed to a level where gearbox
functional failure may be imminent. If such a design feature is selected, the following
considerations are necessary:
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 20 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
3. Proposed amendments and rationale in detail
(i) evidence should be available, preferably from multiple tests, to provide confidence
that the failure mode being monitored is always the most critical failure mode after
loss of lubrication, and that the rate of degradation up to the point of failure is
understood;
(ii) inhibition of the warning to the flight crew in the event that oil pressure is normal
may be considered to reduce likelihood of a false warning resulting in an instruction
to ‘land immediately’; and
(iii) availability/reliability of the warning should be justified; it should be possible to test
the correct functioning of the sensor or warning during pre-flight/start-up checks or
during routine maintenance.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 21 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
4. Impact assessment (IA)
4. Impact assessment (IA)
4.1. What is the issue
As described in Chapter 2 of this NPA, the JCT was set up to conduct a review of the current design
requirements and associated guidance material relating to gearbox loss of lubrication. The final report
of the JCT dated 28 September 2012 includes findings regarding the adequacy of the current
requirements as well as recommendations for amending FAR 29/CS-29 and the associated guidance
material. These recommendations address the following aspects of gearbox and lubrication system
design, aiming both at reducing the risk of occurrence and mitigating the effects of gearbox loss of
lubrication:
— safety assessment of pressurised lubrication systems;
— testing requierements to demonstrate the behaviour of gearboxes experiencing loss of
lubrication; and
— substantiation of a maximum period of continued operation which can be stated in the RFM
emergency procedures.
These recommendations, as stated below, were agreed and further developed by the RMG RMT.0608:
(a) all new CS-29 Category A rotorcraft types should comply with at least one ‘loss of lubrication’
test to meet CS 29.927(c) and the term ‘extremely remote’ should be removed from the
requirement.
(b) a new CS 29.927(c) should define a test which can justify confidence that 30 minutes of
continued flight post loss of lubrication would be probable.
(c) AMC to CS 29.927(c) should be changed to define the method for draining the oil; and
(d) the lubrication systems should be subjected to the rotor drive system design assessment of
CS 29.917(b).
4.1.1. Safety risk assessment
A typical rotorcraft rotor drive system main gearbox consists of many highly loaded dynamic
components that are essential for safe flight and landing. Due to the single-load-path architecture of
rotor drive system designs and the dependence of safety upon the continued integrity of these ‘critical
parts’, it is accepted in the certification process that rotor drive systems are likely to be subject to a
greater risk of failure than other rotorcraft and fixed-wing aircraft systems. The function of a rotor
drive system gearbox is to transmit power from the engines to the rotors, whilst at the same time
reducing rotational speed and increasing torque. Lubrication, usually provided by oil, is an essential
feature of these gearboxes, reducing friction and providing cooling at points of moving contact
between critical gears, shafts and bearings. Consequently, depletion of lubrication supply eventually
results in increased friction, increased temperature and eventually in loss of drive or loss of control of
the rotorcraft.
The capability of early rotorcraft gearbox designs to continue operation after loss of lubrication was
quite limited. Some designs showed that mechanical failure was likely within just a few minutes of
continued operation under power after loss of lubrication. By the 1980s, civilian helicopter passenger
transport was becoming increasingly more established, and the use of helicopters in support of
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 22 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
4. Impact assessment (IA)
offshore industries was also increasing. Consequently, rotorcraft designs were developed to improve
lubrication system reliability and gearbox capability in the event of loss of lubrication in order to
reduce the risk of lubrication failures leading to ditching or crashing into water. In 1988, FAR 29.927(c)
(at Amendment 26) was amended to require gearboxes with pressurised lubrication systems to
demonstrate a capability to continue operation for a minimum of 30 minutes after loss of lubrication
by completing a bench test. This amendment significantly improved the above-mentioned Regulation.
However, a single 30-minute bench test might only provide confidence for an associated RFM
emergency procedure for a much shorter duration of continued flight following lubrication system
failure. Considering the current number of helicopters used for offshore work and the growing need for
transport to locations further offshore, the risk of an accident following lubrication system failure has
increased. Accordingly, to maintain or reduce this risk, there is a need to amend and improve CS-29.
Considering this growing risk to civilian CS-29 helicopters and mindful of lessons learned following
recent accidents, EASA is of the opinion that the current CS-29 provisions addressing rotor drive
system gearbox loss of lubrication need to be amended in order to achieve an acceptable level of
safety. Furthermore, knowledge of and tools for rotorcraft drive system design have improved
significantly since the last amendment of FAR 29.927(c) such that better ‘loss of lubrication’
capabilities can now realistically be achieved. Based on the hazard severity of this failure mode and the
experienced frequency of events, the level of risk is considered to be high.
4.1.2. Who is affected
This NPA will affect designers and operators of large rotorcraft as well as certifying authorities.
The four largest helicopter manufacturers affected by the changes proposed in this NPA are Airbus
Helicopters, Bell Helicopter, Leonardo Helicopters, and Sikorsky Aircraft Corporation.
In February 2016, there were 682 large helicopters operated in EASA Member States (MSs) (see Table 1
below). Approximately 4 out of 10 helicopters are operated in offshore oil and gas support, every fifth
helicopter in medical services, and 4 out of 10 in various other usage categories. Typically, the usage
and the number of passengers carried are higher for offshore oil and gas support operations, thus
increasing exposure to airworthiness risks.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 23 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
4. Impact assessment (IA)
Table 1 — Large helicopters by manufacturer
Manufacturer Fleet
Airbus Helicopters 317
Sikorsky 113
AgustaWestland 93
Bell Helicopter Textron 76
WSK-PZL Swidnik 35
Mil Moscow Helicopter Plant 26
Agusta-Bell 16
Indonesian Aerospace 4
Kamov 2
Total 682
1
In-service and temporarily stored helicopters
operated by EASA MSs civil operators on 10
February 2016
Figure 1 — Large helicopter fleet by usage
Other
Off-shore/oil &
11 %
gas support
40 %
Business/corpora
te/executive
12 %
Medevac/air
Utility (civil multi- ambulance/EMS/
role) airborne hospital
17 % 21 %
4.1.3. How could the issue/problem evolve
The increased number of helicopters currently in service for offshore work, coupled with the growing
need for transport to locations further offshore, potentially increases the risk of an accident following
a lubrication system failure. This is due to the fact that for offshore helicopter operations the capability
to continue flying and subequently land safely after a rotor drive system gearbox ‘loss of lubrication’
event is more critical for this type of operation.
EASA was part of the JCT that recommended improvements to the current ‘loss of lubrication’
requirements and associated guidance material for Category A rotorcraft, intended to be implemented
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 24 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
4. Impact assessment (IA)
in the United States, Canada, and Europe. Therefore, for future harmonisation purposes, it would be
advantageous for EASA to implement these proposed amendments to CS-29 and associated AMC.
4.2. What we want to achieve — objectives
The specific objective of this proposal is to reduce the risks associated with loss of lubrication of rotor
drive system gearboxes and to implement recommendations arising from the JCT’s review of rotorcraft
gearbox certification requirements. This aims to both reduce the potential for lubrication system
failures from occurring and to mitigate the likely consequences of any failure.
4.3. How it could be achieved — options
In order to achieve the above objectives, the options below were identified.
Table 2 — Selected policy options
Option No Short title Description
0 Do nothing Baseline option — no change in rules; risks remain as outlined in the
issue analysis.
1 Amend CS-29 Rulemaking to provide enhanced CSs and AMC that reflect certification
and CS-27 best practice.
Option 1 should provide enhanced CSs and AMC in line with the JCT’s recommendations, including the
following:
All CS-29 Category A new rotorcraft types (i.e. not applicable to variants unless there is an amendment
to 21.A.101) should comply with a ‘loss of lubrication’ test.
Propose an amendment to CS 29.927(c) ‘Additional tests’ to stipulate that a loss of lubrication test is
required. The term ‘extremely remote’ should be removed and the rule should be rewritten to become
a prescriptive ‘loss of lubrication’ durability test of the rotor drive system gearboxes used on
Category A rotorcraft. Essential test parameters should be prescribed, including the torque value(s)
and rotational speed(s), that should be applied to the rotor drive system to ensure that continued level
flight at maximum take-off gross weight (subject to a possible reduction due to fuel burn) can be
maintained for a duration after loss of lubrication.
The duration of the ‘loss of lubrication’ test should consider the operational need, particularly with
regard to offshore operations in support of oil and gas resources. Upon completion of the test, the test
results and the duration of the test should be taken into consideration when developing the
appropriate emergency procedures for loss of lubrication in the RFM.
Lubrication system design should be subject to the drive system design assessment of CS 29.917(b).
The lubrication system is an integral part of the rotor drive system and is necessary for maintaining
continued safe operation of the rotor drive system.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 25 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
4. Impact assessment (IA)
4.4. Methodology and data
4.4.1. Methodology applied
The methodology applied for this IA is the multi-criteria analysis (MCA), which allows comparing all
options by scoring them against a set of criteria.
MCA covers a wide range of techniques that aim at combining a range of positive and negative impacts
into a single framework to allow easier comparison of scenarios. Essentially, it applies a cost-benefit
assessment to cases where there is a need to present multiple impacts representing a mixture of
qualitative, quantitative, and monetary data, and where there are varying degrees of certainty. The
MCA key steps generally include:
— establishing the criteria to be used to compare the options (these criteria must be measurable,
at least in qualitative terms); and
— scoring how well each option meets the criteria; the scoring needs to be relative to the baseline
scenario.
The criteria (safety, economic, environmental, and social) used to compare the options were derived
from the Basic Regulation and the guidelines for the IA were developed by the European Commission.
The scoring of the impacts uses a scale of –5 to +5 to indicate the negative and positive impacts of
each option (i.e. from ‘very low’ to ‘very high’ negative/positive impacts). Intermediate levels of
benefit are termed ‘low, ‘medium’, and ‘high’ to provide for a total of five levels in each one of the
positive and negative directions, with also a ‘no impact’ score possible.
4.4.2. Data collection
The number of helicopters operated by EASA MSs is based on data from Ascend Fleets. It includes
helicopters in service and those out of service and temporarily stored on 10 February 2016.
The financial information used to assess the economic impact is based on the publicly available annual
reports of the largest affected aircraft manufacturers as well as on the development cost estimates
provided by the RMG.
The safety occurrence database of EASA identifies accidents and incidents over the last 10 years. This
database contains accidents and serious incidents within the scope of EASA (i.e. ocurrences involving
European products operating worldwide plus other occurences involving an EASA MS, either as state
of occurrence, state of operator, or state of registry). In addition, the database includes all accidents
with large commercial aeroplanes and rotorcraft worldwide.
4.5. What are the impacts
4.5.1. Safety impact
The analysis relating to CS-29 Category A (or equivalent) rotorcraft occurences and accidents showed
that over the last 10 years there were:
— 1 fatal accident,
— 2 non-fatal accidents,
— 2 serious incidents, and
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 26 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
4. Impact assessment (IA)
— 4 incidents.
Examination of the information available for these 9 events shows that 7 of them involved loss of oil,
and 2 involved loss of oil pressure. Of the 9 events, 8 were determined to result in the need for an
imminent forced landing, and 1 for a landing which might be necessary before reaching a safe landing
site.
Data is not available to estimate how many operating hours were operated by these types of rotorcraft
over the last 10 years, thus, it is not possible to provide a reliable occurence rate relating to these
events. Accordingly, a qualitative assessment has been made.
Note: Over the same 10-year period, there were 2 recorded incidents involving CS-27 Category A
rotorcraft. As discussed in Chapter 2 of this NPA, the safety risk applicable to CS-27 Category A
rotorcraft is considered to be much less significant.
It is qualitatively assessed that approximately 50 % of these incidents could be avoided if the proposed
amended provisions are included in CS-27 and CS-29. This failure condition is currently considered to
be one of the significant airworthiness safety risks for CS-29 rotorcraft, and the proposed risk
mitigation measures would reduce the risk of an incident resulting from a loss of lubrication. This is
particularly pivotal for helicopters that are operated in an offshore environment where it might not be
possible to land immediately in the event of a loss of lubrication. The risk of a accident following a loss
of lubrication could be reduced by subsequently maximising the duration of continued flight time for
the helicopter after the failure has occurred. This would increase the probability of the pilot being able
to find a suitable landing site within the remaining continued flight time.
The following scale was used to assess the safety impact from the proposed amendment to CS-27 and
CS-29:
Reduction in number of Safety Impact Score
events (%)
81-100 % +5
61-80 % +4
41-60% +3
21-40% +2
1-20% +1
0 0
Option 0: No impact on safety is envisaged.
Option 1: It is anticipated that there will be an increase in the level of safety due to the estimated 50 %
reduction in the number of loss of gearbox lubrication events. The qualitative assessment of the safety
benefit gives a score of 3 (medium safety benefit) based upon the 50 % estimated reduction in the
number of events (see safety impact table above).
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 27 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
4. Impact assessment (IA)
Option 0 Option 1
Assessment
Do nothing Amend CS-29 and CS-27
Safety impact 0 +3
4.5.2. Environmental impact
There have been no environmental impacts identified.
4.5.3. Social impact
There are no relevant social impacts for either option.
4.5.4. Economic impact
In order to assess the significance of each identified increase in development costs per new type, these
amounts need to be compared to a financial indicator that accurately represents the affected
manufacturers.
The thresholds expressed in percentages and the corresponding MCA scores are shown in Table 3 and
Table 4 below:
Table 3 — Economic-impact scores
Share of annual turnover
Impact Score
More than No more than
Very high 5 1%
High 4 0.6 % 1%
Medium 3 0.2 % 0.6 %
Low 2 0.05 % 0.2 %
Very low 1 0.01 % 0.05 %
Insignificant 0 – 0.01 %
Table 4 — Economic impact of development costs
Average revenue per manufacturer (2014, in million) EUR 4 920
1
Annual development cost (in million) EUR 0.100
Development cost as share of annual revenue 0.0020%
Impact score Insignificant
Notes:
1
A manufacturer is assumed to deliver a new CS-29 type every 5 years,
therefore the EUR500 000 development cost per type equals EUR100 000
annual cost.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 28 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
4. Impact assessment (IA)
The development cost of EUR 100 000 per year is no more than 0.01 % of the annual revenue of an
average affected manufacturer, which, in accordance with Table 4, equates to an insignificant
economic impact.
Table 5 — Economic-impact scores
Option 0 Option 1
Assessment
Do nothing Enhanced standards
Economic impact 0 0
Option 0 would mean no harmonised certification specifications over the long term, therefore, a low
negative impact is expected.
The intention of Option 1 is that the amended CS-29 and associated AMC will maintain harmonised
certification specifications on this subject over the long term.
4.5.5. General Aviation and proportionality issues
Manufacturers of large rotocraft do not include small and medium-sized enterprises or operators in
General Aviation (GA).
4.6. Conclusion
4.6.1. Comparison of options
Option 0 Option 1
Assessment
Do nothing Enhanced standards
Safety impact 0 3
Environmental impact N/a N/a
Social impact N/a N/a
Economic impact 0 0
GA and proportionality issues N/a N/a
Total score 0 3
The conclusion of this IA is as follows.
Option 0 ‘Do nothing’ would result in no improvement to safety. This is considered to be the e
undesireable option on the basis of the need to address the safety issues described in Chapter 2 above.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 29 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
4. Impact assessment (IA)
Option 1 ‘Enhanced standards’ has the highest score (higher score than Option 0), is considered to
address the safety issues described in Chapter 2, and is assessed to have an only insignificant economic
impact.
Accordingly, Option 1 is recommended.
Note: With only 2 recorded ‘loss of lubrication’ incidents involving CS-27 Category A rotorcraft over the
same 10-year period as the one used for this assessment, the safety risk applicable to CS-27 Category A
rotorcraft is considered to be less significant. Based on the tangible safety improvement through the
enhanced CSs of Option 1, it is proposed that the amended provisions in CS-29 remain equally
applicable to CS-27 Category A rotorcraft by referencing them in CS-27 Appendix C.
4.7. Monitoring and evaluation
Events involving loss of gearbox oil which are hazardous and catastrophic will be monitored in Europe
and the USA through the regulator’s safety data monitoring and analysis functions. Due to the low
frequency of events involving loss of gearbox oil, it may be difficult to monitor any trend data of
occurrences. In addition, due to the fact that the amended certification specifications will be only
applicable to new designs, it will be important to differentiate between occurrences involving pre- and
post-CS-amendment designs. The safety risk portfolios for rotorcraft operations will be closely
monitored for any increased number of occurrences relating to loss of gearbox lubrication.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 30 of 31
An agency of the European Union
European Aviation Safety Agency NPA 2017-07
5. References
5. References
5.1. Related regulations
N/a
5.2. Affected decisions
— Decision No. 2003/16/RM of the Executive Director of the Agency of 14 November 2003 on
certification specifications for large rotorcraft (‘CS-29’); and
— Decision No. 2003/15/RM of the Executive Director of the Agency of 14 November 2003 on
certification specifications for small rotorcraft (‘CS-27’)
5.3. Other reference documents
— Aviation Investigation Report A09A0016 – Main Gearbox Malfunction / Collision with Water.
Cougar Helicopter Inc. Sikorsky S-92A, C-GZCH. ST John’s, Newfoundland and Labrador,
35 NME – 12 March 2009
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 31 of 31
An agency of the European Union